# Tutorial: Phase 5: Enterprise SSO, MSSP & Dual-Key

OIDC-bound tenancy, MSSP co-managed delegation, dual-key executive sign-off
(with TLPT evidence pack), and marketplace SIEM app payloads for decoy-touch.

**Time:** ~30-45 minutes  
**Plane:** Ops management

## Prerequisites

- OIDC issuer/audience/JWKS for production (`CYBERHALLUCINET_OPS_OIDC_*`): see
  TDD-440
- Tenancy roles: `mssp_delegate`, `exec_signer`, `fleet_admin`, …

## 1. OIDC + tenant isolation (TDD-440)

Production Ops requires authenticated operators. OIDC ID tokens must carry
`tenant_id` and scopes/roles. Cross-tenant access is fail-closed via
`tenancy.Allowed` and `TenantFromRequest`.

```bash
# Smoke OIDC-bound meta (example)
curl -sS -H "Authorization: Bearer $OIDC_ID_TOKEN" \
  http://127.0.0.1:8080/api/meta
```

## 2. MSSP delegate (TDD-441)

Roles come from the authenticated principal: do not assert `roles` in the body
for authorization. An IdP-assigned `mssp_delegate` or `fleet_admin` first
creates the durable server-side grant; delegated actions then reference only
that grant ID.

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action":"grant","delegation":{"delegation_id":"deleg-0001","customer_tenant":"tenant-a","mssp_tenant":"tenant-mssp","actor":"mssp-alice","actions":["itsm_sync"],"expires_at":"2030-01-01T00:00:00Z"}}' \
  http://127.0.0.1:8080/api/mssp/delegate

curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action":"itsm_sync","delegation":{"delegation_id":"deleg-0001"},"system":"jira","asset_tag":"A-1","cmdb":"CI-1","plant_result":{"token_hash":"<64-hex>","kind":"decoy_cred_aws","location":"s3://x","owner":"ops","environment":"lab"}}' \
  http://127.0.0.1:8080/api/mssp/delegate
```

## 3. Dual-key sign-off + TLPT pack (TDD-443)

Two distinct authenticated principals. Key B is a second bearer in
`X-CHN-Dual-Key-B` (not JSON role claims).

```bash
curl -sS \
  -H "Authorization: Bearer $OPS_TOKEN_A" \
  -H "X-CHN-Dual-Key-B: $OPS_TOKEN_B_RAW" \
  -H "Content-Type: application/json" \
  -d '{"request":{"request_id":"req-00001","action":"tlpt_close","payload_ref":"tlpt-run-1","key_a_actor":"exec-1","key_b_actor":"exec-2"}}' \
  http://127.0.0.1:8080/api/dualkey/signoff
```

Expect `tlpt_evidence_pack` and `dora_certified: false`.

How-to: [dual-key-signoff.md](../how-to/dual-key-signoff.md)

## 4. SIEM marketplace apps (TDD-445)

Decoy-touch Format path + catalog plugins `siem-app-splunk` / `siem-app-sentinel`
(and Day-1 `siem-decoy-touch-sop`):

```bash
curl -sS -H "Authorization: Bearer $OPS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"plugin_id":"siem-app-splunk","sensor_id":"s1","session_id":"sess","source_ip":"203.0.113.9"}' \
  http://127.0.0.1:8080/api/siem/decoy-touch
```

`auto_contain` remains false on all SIEM app payloads.

## Related

- Tenant isolation: [tenant-data-isolation.md](../architecture/tenant-data-isolation.md)
- Marketplace checklist: [private-offer-checklist.md](../marketplace/private-offer-checklist.md)
- API catalog: [ops-phase35-api.md](../reference/ops-phase35-api.md)